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This paper describes a model-predictive automatic recovery system for aircraft on the 
verge of a loss-of-control situation. The system determines when it must intervene to prevent 
an imminent accident, resulting from a poor approach. It estimates the altitude loss that 
would result from a go-around maneuver at the current flight condition. If the loss is 
projected to violate a minimum altitude threshold, the maneuver is automatically triggered. 
The system deactivates to allow landing once several criteria are met. Piloted flight 
simulator evaluation showed the system to provide effective envelope protection during 
extremely unsafe landing attempts. The results demonstrate how flight and propulsion 
control can be integrated to recover control of the vehicle automatically and prevent a 
potential catastrophe. 


I. Introduction 

O n July 6, 2013, an Asiana Airlines Boeing 777 on final approach to San Francisco International Airport (SFO) 
came in too low and too slow. Shortly before reaching the runway threshold, the throttles moved forward 1 to 
increase power and thus airspeed, possibly in an attempt to perform a go-around. However, before the additional 
power could have an effect, the aircraft pitched up and the tail section hit the seawall at the end of the runway. The 
impact broke off the empennage and landing gear, and the craft skidded, spinning and burning, down the runway. 

On this fateful flight, the aircraft was below glideslope and going too slowly during approach. 2 A common 
method of maintaining glideslope is for the pilot to manipulate pitch. Directed by the glideslope indicator, the pilot 
pulls the nose up if the craft is too low, and pushes the nose down if it is too high. Simultaneously, the pilot should 
be monitoring and maintaining airspeed by adjusting the throttle. 3 Alternatively, the autothrottle can perform the 
latter function, if engaged. Sometimes, the pilot neglects airspeed for some reason (workload, distraction, 
concentration on maintaining glideslope, mistaken belief that the autothrottle is engaged, etc.) and lets airspeed get 
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too low. In the case of Asiana Flight 214, there may have been some confusion about the autothrottle setting, 2 * which 
could have been a contributing factor. If airspeed gets too low, it can be addressed automatically by an autothrottle 
“wake up” mode. This is a form of emergency protection that can activate to increase thrust when the plane is 
approaching stall speed, 4 but it is not available in all autoflight modes. 5 

The glideslope itself is an approximately 3° path down to the ground, crossing the runway threshold at an altitude 
of about 50 feet before intersecting it at the aiming point 1000 feet further on. In a stabilized approach, 6 the plane 
generally flies down the glideslope at a relatively constant pitch; once it has passed the threshold and enters the 
ground effect, it flares to reduce sink rate and touches down. Rushed and unstabilized approaches are the largest 
contributing factor to approach and landing accidents. Continuing an unstabilized approach is a causal factor in 40% 
of all approach and landing accidents. 7 Combined, high and/or fast approaches and low and/or slow approaches are 
a causal factor in 66% of such events. 7 

The Asiana Airlines accident is currently under investigation and much is not known. It is known, however, that 
eight seconds prior to impact, the throttles began moving forward; at that time, altitude was below glideslope at 125 
feet, and air speed was approximately 112 knots, well below the 137 knot reference landing speed. It is not known at 
the time of this writing whether the pilots moved the throttles manually, or if the autothrottle wake up mode had 
activated. In any case, at about three seconds before impact, when the speed had dropped to 103 knots, the engines 
were only at about 50% power and increasing. By time of impact, airspeed had increased to about 106 knots. 1 

Federal Aviation Administration (FAA) regulations require a time of not more than five seconds to accelerate 
from 15% to 95% of takeoff power. 8 Furthermore, the thrust achieved after eight seconds from power application 
(starting from minimum flight idle) must allow a climb gradient of not less than 3.2% for go-around. 9 However, if 
the aircraft is descending, i.e., on approach, when the go-around maneuver is initiated, it will continue to experience 
an altitude loss before achieving this climb. Generally, the lower the initial airspeed and thrust, the greater the 
altitude loss and time required before sink rate is reversed, especially when the aircraft is flying below approach 
speed and near idle power. Lack of thrust in particular is strongly correlated with altitude loss. 1,1 During an 
automatic go-around initiated at 50 feet, a Boeing 111 will lose approximately 30 feet of altitude. 4 If a go-around is 
required, the procedure given in the Boeing 111 Flight Crew Training Manual is to push the takeoff/go-around 
(TO/GA) switch, set flaps to 20 degrees, apply go-around thrust, and rotate smoothly to 15° pitch attitude. 4 

Deceleration to below final approach speed can be acceptable under certain circumstances, but throttles must be 
advanced to maximum thrust when initiating the go-around maneuver. 10 If an extremely low airspeed is achieved 
while the throttles are at idle, it may be the result of an unstabilized approach. If, in addition, the aircraft is close to 
the ground, as was the case with Asiana Flight 214, the altitude loss while the engines are spooling up can be 
catastrophic. 

The previously mentioned autothrottle wake up mode is part of a larger envelope protection scheme on the 
Boeing 111 and other aircraft. In general, the purpose of envelope protection is to keep the vehicle within its safe 
performance limits by inhibiting violations of parameters such as minimum and maximum operating speeds, bank 
angle, and aerodynamic forces. It deters the pilot from trying to operate outside of this safe range, although pilot 
override is possible. 11 Much of this envelope protection is accomplished automatically with the autopilot, and as 
with the autothrottle, it is not available in all flight modes. 5 This leads to the question of Asiana Flight 214 and the 
automation crack through which it fell. If no envelope protection was available, an unchecked confluence of events 
caused the aircraft to enter into a loss-of-control situation from which it could not recover. On the other hand, if the 
autothrottles woke up and advanced the throttles as the airspeed approached stall speed, it was already too late to 
save the plane given the altitude and engine spool-up time. 

This is one of several recent accidents that occurred on approach and resulted in fatalities. For some of them, 
investigations are ongoing and no cause has yet been determined, but there is speculation that pilot error could be to 
blame. 2 ' 12 ' 13 Cases of unstabilized approaches and crash landings short of the runway have generated discussions 
about automation confusion and the erosion of piloting skills due to overreliance on automation. 14 These are training 
and human factors concerns that must be addressed, but ironically, some of the direst consequences of these 
automation-related problems can be prevented by adding another layer of automation 15 : a supervisory envelope 
protection scheme that anticipates loss-of-control accidents and intercedes to prevent them. 

The remainder of this paper describes a new model-predictive automatic recovery system that determines if the 
landing is salvageable. It gives the pilot the benefit of the doubt that he/she can land the aircraft safely until the last 
instant, at which time the system automatically takes over and initiates a go-around. The following sections describe 
the philosophy behind the design, which is followed by a description of the implementation approach. Then the test 
bed is described and examples of the system in operation are presented. This is followed by a discussion and 
conclusions. 
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Figure 1. Model-predictive automatic recovery system demonstrating altitude loss prediction. The green 
line indicates that the predicted altitude loss due to a go-around from high up on the glideslope will not 
cause a threshold violation. As the aircraft continues to descend and it approaches the altitude threshold, 
the prediction of altitude loss (red line) indicates a threshold violation will occur. 

II. Philosophy of the model-predictive automatic recovery system 

The proposed model-predictive automatic recovery system looks ahead over a time horizon to ensure that the 
aircraft will not experience premature contact with the ground, and initiates an automatic go-around if necessary. It 
can be considered a very specialized integrated flight and propulsion control system, since it coordinates both the 
throttle and aircraft attitude commands for this single purpose. It is fully contained onboard the aircraft, with landing 
information available from sources such as an Instrument Landing System (ILS) or Global Positioning System 
(GPS). The functionality fits naturally within the envelope protection system of the aircraft, which imparts a design 
philosophy to it: it should not interfere with flight operation until the situation has reached the edge of becoming 
unrecoverable, at which point the system must recognize this and automatically recover from it; additionally, it must 
be able to be overridden for emergency landings, for instance. The system was designed with the assumption that the 
pilot intends to land the aircraft safely on the runway, and it determines whether this is possible. Its purpose is to 
prevent the aircraft from approaching too close to the ground unless it is near the runway and at an appropriate 
airspeed to avoid crashing. It does not require a stabilized approach; it gives the pilot leeway to continue flying as 
long as an accident is not imminent. The system only reacts once it concludes that, without intervention, an accident 
will take place. Here an accident is defined as a situation in which, even if an immediate go-around is performed, the 
craft’s altitude will drop below a given threshold, when it is not over the runway. Because the system identifies the 
brink of when safe landings are no longer possible and there is no alternative but to go around, it can handle a 
variety of situations: low and slow, high and fast, stabilized descent short of the runway, and other conditions that 
have a very strong likelihood of disaster. 

The system predicts the altitude loss that would be sustained during an immediate go-around maneuver from the 
current flight conditions. If that altitude loss would result in the aircraft dipping below a given altitude threshold 
prior to reaching the runway, an immediate go-around is initiated. Otherwise, the flight continues on under pilot 
control and the altitude loss prediction is repeated at discrete intervals, as illustrated in Figure 1. The threshold is 
designed to provide a buffer to allow for prediction error, obstacles, etc., but be small enough that the airplane would 
never reasonably get that low under normal circumstances unless it is near the runway. The system turns off to 
enable landing when the flight path brings the craft near to and aligned with the runway and below a specified 
altitude (Figure 2). At this point, it is assumed that the plane is positioned for the pilot to perform a safe landing. It is 
important to emphasize again that if this situation is realized, there has been no intervention and the pilot has 
performed a satisfactory approach; the system protects against dangerously unsatisfactory approaches, it does not 
make the approach better. Details of the system implementation are provided in the next section. 
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Figure 2. Notional view of the aircraft passing through the altitude threshold (yellow line) to the runway. 
The overhead view (top) depicts the aircraft descending into the safe landing zone for the runway. 
Prediction of go-around induced altitude loss, designated by green lines along the glide path (bottom), 
turns off once the aircraft enters the runway area on a safe landing trajectory. This situation is indicated 
by the aircraft’s location within the safe landing zone without experiencing an altitude threshold violation. 

III. Procedure 

The model-predictive automatic recovery system consists of three primary components: the flight and propulsion 
control override mode, the flight path predictor, and the trigger system. When activated, the override mode exerts 
full authority over the primary flight and propulsion controls in order to modify the flight trajectory and avoid 
ground contact. The flight path predictor detects the onset of unsafe operation (i.e., impending ground contact). The 
trigger system utilizes current and projected flight conditions to activate or disable the override mode (Figure 3). 
This approach is conceptually similar to the Ground Collision Avoidance System (GCAS) developed for military 
aircraft. Both manually 16 and automatically 17 ' 18 activated recovery systems have been previously investigated for 
military aircraft. However, these systems are tailored towards the higher energy regime of the flight envelope. For 
civil transport applications, it is at least as important to focus on recovery from low-altitude, low-speed (e.g., 
approach) loss-of-control situations. 

A. Override Mode 

The Override (OR) Mode modifies the aircraft flight trajectory to avoid premature ground contact. Thus, the 
control mode is functionally similar to the go-around (GA) flight mode for modern transport aircraft. For this work, 
relatively simple control logic was developed for demonstration purposes, but a GA mode could alternatively be 
used, if available. Here, pitch and roll control algorithms were utilized to build a control mode that executes a 
rudimentary GA maneuver. Specifically, when triggered, the OR Mode will: 

• Command full throttle 

• Manipulate elevator position to achieve approximately 15° nose-up pitch angle 


4 

American Institute of Aeronautics and Astronautics 



Figure 3. Flow chart of the Model-Predictive Automatic Recovery System. If the aircraft has not met the 
landing criteria, it predicts if the flight is about to become unrecoverable, and if so, triggers a go-around. 

• Manipulate aileron position to achieve approximately 0° roll angle 

• Maintain aircraft configuration (i.e., flaps and landing gear are not retracted) 

These characteristics are similar to those in a standard GA procedure. 4 In simulation testing, maintaining the 
flaps in landing configuration resulted in the smallest altitude loss. 

Additionally, simulation results from a variety of initial airspeeds and glide path angles with throttle at flight idle 
showed that the minimum altitude achieved before climb occurred less than 10 seconds after initiation of the GA 
maneuver. Figure 4 demonstrates this for several examples of altitude loss with different initial airspeeds and sink 
rates. These results correspond well to the FAA time requirement for go-around climb, 9 suggesting that the OR 
Mode produces a reasonable representation of a standard GA maneuver. 

B. Flight Path Predictor 

The flight path predictor (FPP) is a simplified, two-dimensional, rigid-body physics model of the aircraft, used to 
determine the altitude loss that would result from a go-around maneuver. Lateral dynamics of the aircraft are 
neglected (i.e., constant heading, zero roll/sideslip, etc.) since the primary application considered for this work is the 
approach/landing phase. Wind is also neglected for simplicity. Thus, applying Euler’s Laws of Motion to the aircraft 
longitudinal characteristics yields the following equations of motion: 

F X = mV> A 

F, = —mh 

M = 1^6 


Assuming a Flat Earth inertial reference frame with the positive x-axis in the direction of aircraft heading and the 
positive z-axis pointing downward, the quantities in the equations are defined as: 

m = aircraft mass 

Iyy = aircraft pitching moment of inertia 
F x = net force along the x-axis 
F - = net force along the z-axis 
M = net pitching moment 
V x = air speed along the x-axis 
h = altitude 
8 = pitch angle 
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Figure 4. Altitude loss during a go-around performed using the model-predictive automatic recovery 
system. The runs comprise various initial airspeeds and glide path angles; in all cases the throttle is at or 
near idle. True Air Speed, TAS, in knots, and sink rate in feet per minute at initiation are given for each 
case. The time to minimum altitude is approximately ordered by initial airspeed. At the longest, the 
minimum altitude occurred about five seconds after the maneuver was triggered. 


The model accounts for longitudinal forces and moments due to aerodynamics and propulsion. The model 
assumes knowledge of the airframe aerodynamic characteristics due to angle of attack, Reynolds Number, and 
control surface deflections. Engine thrust is approximated as the response of a second-order dynamical system to 
throttle position input, which is a function of starting position (e.g., flight idle) and speed of engine response. Hence, 
once the physical characteristics of the airframe (mass, moment of inertia, etc.) and control parameters (control 
surface deflections and throttle) are specified, the system of equations is well-defined; all other relevant parameters 
(angle-of-attack, air speed, etc.) can be derived from the state variables. 

The previously described OR Mode control logic is applied to the simplified aircraft model in a closed-loop 
feedback configuration to provide the necessary control inputs (e.g., elevator deflection, throttle position, etc.). This 
interconnection represents the complete FPP architecture (Figure 5). 

C. Trigger System 

The purpose of the trigger system is to determine if the OR Mode must be activated to avoid unintended ground 
contact. The trigger system queries the FPP at regular time intervals (once per second in this implementation) to 
obtain an estimate of the maximum altitude loss the aircraft would experience if it were to execute the full-throttle 
go-around maneuver implemented by the OR Mode. At each request, the FPP computes ahead 20 seconds starting 
from the current measured flight conditions, using simulated flight and propulsion control inputs from the OR Mode. 
This time horizon is chosen to ensure the full altitude loss and recovery trajectory is captured. The FPP runs much 
faster than real-time; for this work, approximately 0.4 seconds of computational time is required for the 20-second 
time horizon. If the reported altitude loss will cause the aircraft to fly below a preset minimum altitude threshold, the 
OR Mode is activated, initiating the go-around and superseding pilot commands. To account for prediction errors, 
this minimum altitude threshold was chosen to be 50 feet above ground level everywhere except within a 
predetermined distance of the runway. 


6 

American Institute of Aeronautics and Astronautics 



Initial Values of: 
Altitude (h) 
Air speed 
Flight path angle (Y) 
Vertical air speed ( h ) 
Pitch (9) 
Pitch rate (9) 
Flap position 
Throttle position 


Aircraft 

and 

Engines 


Figure 5. Block diagram of the Flight Path Predictor. The simplified model is initialized to the current 
flight condition. The go-around commands are applied and the maneuver is simulated over a 20 second 
time horizon. The minimum altitude prediction is used to trigger the Override Mode, if necessary. This 
process is repeated as long as the Override Mode has not triggered and the trigger system has not 
deactivated. 


To allow the aircraft to land, the trigger system deactivates the protection system if a set of conditions are 
satisfied. Assuming that the heading is correct for approach on the designated runway, the criteria are: 

• The aircraft is within about 1000 feet (horizontal distance) of the runway threshold. At this point, the FPP 
altitude threshold is set to zero 

• The aircraft is less than 50 feet above ground level 

If these conditions are met simultaneously without triggering a predicted trajectory violation from the FPP, the 
OR Mode is disabled, permitting the aircraft to touch down. 


IV. Experimental Test Bed 

Piloted evaluation of the model-predictive automatic recovery system was performed in the NASA Glenn flight 
simulator. The aircraft model was the NASA-developed Transport Class Model (TCM), 19 a generic, mid-sized, 
single-aisle transport aircraft with two wing-mounted engines. Two copies of the Commercial Modular Aero- 
Propulsion System Simulation 40k (C-MAPSS40k), 20 ' 21 the NASA-developed, 40,000-lb thrust class, high-bypass 
ratio turbofan engine model, represented the power plants. The closed-loop C-MAPSS40k engine meets the relevant 
FAA thrust response criterion, as shown in Figure 6. The C-MAPSS40k simulations were modified to include the 
detrimental effect of inlet distortion due to high angle of attack on engine thrust output, which can be significant in a 
loss-of-control event. 22 This combination of aircraft and engine models provides a realistic, nonlinear, full-envelope 
aircraft simulation. Furthermore, the cockpit has a reasonably comprehensive, fully configurable pilot interface, 
which delivers an immersive environment for highly representative testing and evaluation. 


V. Examples 

The experiments were based on situations that could lead to loss of control, such as the Asiana Airlines Flight 
214 accident. Although the flight simulator models a different aircraft, the outcomes should be qualitatively similar. 
The demonstration flights were initiated at 3 nm out from SFO runway 28L, lined up on the correct heading, 
airspeed of 135 kts, and 1000 ft above ground level (AGL) (Figure 7). The stall speed of the TCM is about 100 kts. 
It has spoilers that can be used as speed brakes, although they were not for these experiments. The landing 
configuration is with the gear down and flaps fully extended. 

Several example flights were flown by the pilot from the starting point toward the runway. The pilot performed 
variations of regular landings from a stabilized approach, but also flew a stabilized approach on a glideslope with the 
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Figure 6. C-MAPSS40k Response to FAR 33.73b — Power or thrust response. Rise time requirement from 
not more than 15 percent of the takeoff thrust to 95 percent of the takeoff thrust in not over 5 seconds. 

aiming point short of the runway threshold, and various unstabilized approaches, coming in high and fast, and low 
and slow. A nominal run is illustrated in Figure 8; all variables are plotted versus distance from a safe landing spot 
just beyond the runway threshold, meaning that trajectory /time is shown from right to left. The top graph shows the 
altitude of the aircraft (solid blue line) along with the predicted minimum altitude that would result from initiating a 
go-around at each point along its flight path (red dashed line). The black dashed lines indicate the safe landing 
criteria: the horizontal line indicates the 50-foot altitude threshold, and the vertical line indicates the distance before 
the runway (about 1000 ft) where the altitude threshold drops to zero. As previously mentioned, the protection 
system is deactivated to allow landing once the aircraft is within 1000 ft of the runway and under 50 ft AGL with no 
predicted threshold violation. The point where this occurs is indicated by the blue circle. This is followed by a plot 
of vertical speed (sink rate), which is slightly faster than recommended for a stabilized approach (greater than 1000 
ft per minute), 6 but is not sufficient cause to reject the landing. The third plot down is the altitude loss prediction, 
which is repeatedly generated throughout the approach; the discretization is due to the relatively low frequency at 
which the FPP is executed (once per second). Note that the profile of the altitude loss prediction is quantitatively 
similar to that of vertical speed. This is not surprising since the aircraft generally requires more altitude to recover 
from higher sink rates. Finally, throttle position (percent of full range) is displayed (both throttles move together). 

Figure 9 depicts five failed approaches that were automatically rejected by the model-predictive automatic 
recovery system. The circle on each curve indicates the point at which the automatic go-around triggered, so for 
each variable shown for a specific run, the circles coincide. Here again the top plot shows the aircraft’s altitude. On 
this plot it is clear that the prediction and go-around initiation system worked as it should, because the curves all 
come close to or dip below the threshold (the horizontal dashed line) and start increasing again, and all but the green 
line change direction in the vicinity of the threshold. The upper portion of Figure 10 zooms in on the section of this 
altitude plot in the area where the flight path nears the altitude threshold. The lower part of the Figure 10 shows the 
predicted threshold violation that initiated the go-around, again marked with a circle; note that although a threshold 
violation was predicted by the simplified model, the actual maneuver did not necessarily result in a violation. 
Continuing with Figure 9, the second plot down shows airspeed in knots, followed by vertical speed (sink rate) in 
feet per minute (third plot). The fourth plot shows pitch angle, and it is clear that after mode initiation, in all cases 
the pitch tends toward the 15° setpoint. The final plot shows throttle position, which goes to 100% immediately 
upon mode initiation. The five cases demonstrate the versatility as well as a limitation of the system. 
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Figure 7. Flight simulator test bed demonstrating approach into SFO Runway 28L. 


In the case of the blue curve, the aircraft came in high and fast. The top plot shows it continued at a nearly 
constant altitude until about 0.8 nm out, at which point it started to dive toward the runway. Airspeed and 
corresponding sink rate increased, as pitch angle dropped rapidly into the dive, until the automatic go-around 
initiated, the throttles went to 100%, and the nose pulled up sharply toward the 15° commanded pitch. Because of 
the large sink rate, the OR Mode is triggered well above the altitude threshold. 

The red curve demonstrates a good, stabilized approach at an appropriate, consistent airspeed, but on a glide path 
that ends short of the runway. In this case, the pilot had opportunity to modify the glide path and head for the 
runway, but did not, which eventually triggered the system as the aircraft neared the altitude threshold. The magenta 
curve is similar to the red curve, but at a lower airspeed. Here too, the mode triggers very close to the altitude 
threshold. 

The cyan and green lines represent cases in which the airspeed drops dangerously low during the approach, 
similar to Asiana Flight 214. In these cases, because of the low airspeed, the mode is triggered further from the 
altitude threshold than in the two previous, more stabilized approaches. 

Interesting to note is that for the green curve, the aircraft comes relatively close to the ground before beginning 
to climb. This can be explained by the latency associated with the prediction mechanism. Recall that the FPP is 
executed once per second to predict a 20-second time horizon; this frequency is about two orders of magnitude 
slower than that at which the propulsion and flight control systems operate. The circle on the green curves indicates 
where the mode was triggered, and on the pitch trace, the pilot commanded a sudden pitch down, with 
corresponding increase in sink rate, just prior to mode initiation. The pitch rate of change was relatively high 
compared to the update rate of the altitude loss estimation, overwhelming the ability of the protection system to 
“keep up” with the flight dynamics. Thus accurate prediction of the altitude loss can be thwarted by rapid 
aerodynamic changes that can occur during the update cycle of that calculation. 

The current research implementation does not provide a way to disengage the Override Mode once it has been 
initiated; doing this correctly is a human factors issue. However, one can conceive of several reasonable approaches. 
For example, once a given climb rate or altitude is achieved, the autopilot could initiate an altitude and speed hold, 
at which point the pilot could retake control. 


VI. Discussion 

The system was tested on a variety of acceptable stabilized approaches, as well as types of approaches that can 
lead to loss-of-control accidents. While the system worked as expected, several potential improvements were 
identified. The previously mentioned latency associated with the altitude loss estimate has the potential to cause 
significant underprediction. Speeding up the calculation cycle would help to eliminate this source of error. There is 
significant built-in margin here currently, with the estimation performed every second, while the 20-second time 
horizon takes only about 0.4 seconds to execute. Using an 8- tolO-second time horizon with less idle time could 
reduce the cycle by about 80%. 
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Figure 8. Example of stabilized approach showing altitude and the predicted minimum altitude due to a 
go-around, vertical speed, prediction of altitude loss, and throttle percent of full range. 


An integrated flight and propulsion approach was used to perform the go-around maneuver. The coordinated 
commands were based on documented procedures, but were developed outside of the existing flight control system 
for proof of concept. Utilizing an actual TO/GA mode might produce better results in terms of reducing altitude loss. 

On occasion, the fixed altitude threshold has caused the system to trigger on what appeared to be an acceptable 
flight path toward the runway. Figure 1 1 shows an example of an approach in which the prediction just missed 
touching the corner before the threshold dropped to zero; had the prediction dropped below 50 ft while the aircraft 
was still slightly farther than 1000 ft from the runway, the go-around would have triggered, even though it turned 
out to be a good landing. The location of this corner is the result of a trade-off between avoiding false alarms and 
minimizing the distance before the runway threshold that could be violated on a steep approach. A way to reduce the 
need to make this trade-off is to ramp the altitude threshold down to a point beyond the runway threshold. 
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Figure 9. Examples of failed approaches showing altitude, airspeed, vertical speed, pitch angle, and throttle 
percent of full range. The circle on each curve indicates the point at which the automatic go-around triggered. 


A related improvement involves accounting for the predicted go-around trajectory, as shown in Figure 2. While 
the altitude loss prediction is fundamental to the process and continuously updated, the aircraft’s corresponding 
forward movement, which is determined concurrently, is not used. This is inconsequential when the altitude 
threshold is of a fixed height, but not when it changes, e.g., the ramp proposed above, which varies with distance 
from the runway. Projecting the altitude loss forward accounts for the threshold at the point where the minimum 
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Figure 10. Detail of the initiation of the go-around maneuvers for the rejected approaches. The actual 
altitude is shown (top), along with the predicted altitude, showing the predicted threshold violations. Note 
that the prediction stops once the go-around is initiated. 

altitude would actually occur. The current approach effectively creates an artificial altitude buffer at the threshold lip 
because it simply subtracts the predicted altitude loss from the altitude at the present location; it does not project it 
forward. The predicted minimum altitude that just missed the threshold lip in Figure 1 1 would actually occur at 
some point ahead of the aircraft, where the threshold had already dropped to zero, so it would not come close to 
triggering a go-around. 

Areas that require further evaluation involve updates to the FPP that would be necessary for a real application. 
Currently, the FPP uses actual values of aircraft mass, moment of inertia, and aerodynamic forces available from the 
simulation. A more realistic implementation would require estimates of these values, which could lead to larger 
error in the predictions. 

Also, lateral dynamics of the aircraft are neglected in the model, although testing showed this did not add much 
uncertainty for the approach cases considered. 

Finally, wind is not accounted for in the prediction, which could have an effect on the prediction accuracy. 
Certainly, consideration of crosswinds would strengthen the need to incorporate some lateral control and dynamics 
parameters into the flight path prediction algorithm. 

VII. Conclusions 

A new model-predictive automatic recovery system, an envelope protection algorithm to help guard against 
unintended ground contact, has been proposed and demonstrated. It determines when ground contact is about to 
become inevitable, and at that point automatically initiates a go-around. The type of accidents it addresses are due 
primarily to pilot error, and it acts in a supervisory capacity to ensure that such concerns as confusion about the 
autopilot and autothrottle modes cannot result in loss of control. It provides a safeguard by overriding the flight and 
propulsion control commands once it determines that inaction will result in a crash. Piloted simulations 
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Figure 11. Flight path of a successful landing showing altitude and predicted altitude loss versus distance 
from runway. Although this landing was acceptable, it nearly triggered a go-around. The blue circle 
indicates where the system disengaged to allow landing. 

demonstrated that the system worked as intended, allowing normal operation in all instances, but intervening 
consistently when an unrecoverable situation was imminent. A variety of unstabilized approaches were tested, as 
well as stabilized but otherwise deficient approaches. Analysis of these runs identified adjustments that could both 
reduce potential false alarms and reject marginally unacceptable landings. There is a fine line between acceptable 
and unacceptable landings, so making the decision to initiate a go-around in a borderline situation is difficult and 
requires some level of autonomy. Any adjustments that might result in an overall improvement rather than a tradeoff 
are very positive developments and should be investigated. Luckily the types of accidents addressed here are rare 
and the vast majority of landings are squarely in the acceptable range. However, in those rare cases in which some 
type of error on approach would normally result in premature ground contact, the model-predictive automatic 
recovery system has the potential to prevent the situation from turning deadly. 
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